Fix CI runner: seed images to abrban/, kubectl via alpine init, Kaniko Jobs for builds.

Harbor proxy-cache works from core API but containerd can't use it directly,
so all runner images are seeded to abrban/ project.

Co-authored-by: Cursor <cursoragent@cursor.com>

.gitea/workflows/build-deploy.yaml

@@ -1,50 +1,127 @@
 name: Build and Deploy Platform
 on:
   push:
-    branches: [main, master]
+    branches: [main]
+    paths-ignore:
+      - "gitops/platform/values-abrban.yaml"
+      - "**.md"
   workflow_dispatch:
 
 env:
-  # Push via internal Harbor registry (no creds needed from runner pod)
+  REGISTRY: harbor-registry.cloudhost.svc.cluster.local:5000
-  REGISTRY_INTERNAL: harbor-registry.cloudhost.svc.cluster.local:5000
+  PROJECT: abrban
-  REGISTRY: registry.abrban.com
+  BUILD_NS: cloudhost-builds
-  BACKEND_IMAGE: abrban/cloudhost-backend
-  FRONTEND_IMAGE: abrban/cloudhost-frontend
 
 jobs:
-  build-push-deploy:
+  build-and-deploy:
-    runs-on: abrban-kaniko
+    runs-on: abrban-builder
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
       - name: Set image tag
-        shell: bash
+        shell: sh
         run: |
           SHA="${GITHUB_SHA:-$(git rev-parse HEAD)}"
-          echo "IMAGE_TAG=$(date +%Y%m%d-%H%M)-${SHA:0:8}" >> "$GITHUB_ENV"
+          TAG="$(date +%Y%m%d-%H%M)-$(echo $SHA | cut -c1-8)"
+          echo "IMAGE_TAG=${TAG}" >> "$GITHUB_ENV"
+          echo "Build tag: ${TAG}"
 
-      - name: Build backend (Kaniko)
+      - name: Build backend image (Kaniko Job)
+        shell: sh
         run: |
-          /kaniko/executor \
+          cat <<ENDJOB | kubectl apply -f -
-            --context=./backend \
+          apiVersion: batch/v1
-            --dockerfile=./backend/Dockerfile \
+          kind: Job
-            --destination="${REGISTRY_INTERNAL}/${BACKEND_IMAGE}:${IMAGE_TAG}" \
+          metadata:
-            --insecure \
+            name: build-backend-${IMAGE_TAG}
-            --skip-tls-verify
+            namespace: ${BUILD_NS}
+          spec:
+            ttlSecondsAfterFinished: 600
+            backoffLimit: 1
+            template:
+              spec:
+                restartPolicy: Never
+                imagePullSecrets:
+                  - name: registry-pull-secret
+                initContainers:
+                  - name: clone
+                    image: ${REGISTRY}/${PROJECT}/act-runner:0.2.11
+                    command: ["sh", "-c", "git clone --depth=1 --branch main http://gitea-http.gitea.svc.cluster.local:3000/abrban/cloud-host.git /workspace"]
+                    volumeMounts:
+                      - name: ws
+                        mountPath: /workspace
+                containers:
+                  - name: kaniko
+                    image: ${REGISTRY}/${PROJECT}/kaniko-executor:v1.27.6-debug
+                    command:
+                      - /kaniko/executor
+                    args:
+                      - --dockerfile=/workspace/backend/Dockerfile
+                      - --context=dir:///workspace/backend
+                      - --destination=${REGISTRY}/${PROJECT}/cloudhost-backend:${IMAGE_TAG}
+                      - --insecure
+                      - --skip-tls-verify
+                    volumeMounts:
+                      - name: ws
+                        mountPath: /workspace
+                volumes:
+                  - name: ws
+                    emptyDir: {}
+          ENDJOB
+          echo "Waiting for backend build..."
+          kubectl -n ${BUILD_NS} wait --for=condition=complete job/build-backend-${IMAGE_TAG} --timeout=20m
+          echo "Backend build done"
 
-      - name: Build frontend (Kaniko)
+      - name: Build frontend image (Kaniko Job)
+        shell: sh
         run: |
-          /kaniko/executor \
+          cat <<ENDJOB | kubectl apply -f -
-            --context=./frontend \
+          apiVersion: batch/v1
-            --dockerfile=./frontend/Dockerfile \
+          kind: Job
-            --build-arg=NEXT_PUBLIC_API_URL=https://api.abrban.com \
+          metadata:
-            --destination="${REGISTRY_INTERNAL}/${FRONTEND_IMAGE}:${IMAGE_TAG}" \
+            name: build-frontend-${IMAGE_TAG}
-            --insecure \
+            namespace: ${BUILD_NS}
-            --skip-tls-verify
+          spec:
+            ttlSecondsAfterFinished: 600
+            backoffLimit: 1
+            template:
+              spec:
+                restartPolicy: Never
+                imagePullSecrets:
+                  - name: registry-pull-secret
+                initContainers:
+                  - name: clone
+                    image: ${REGISTRY}/${PROJECT}/act-runner:0.2.11
+                    command: ["sh", "-c", "git clone --depth=1 --branch main http://gitea-http.gitea.svc.cluster.local:3000/abrban/cloud-host.git /workspace"]
+                    volumeMounts:
+                      - name: ws
+                        mountPath: /workspace
+                containers:
+                  - name: kaniko
+                    image: ${REGISTRY}/${PROJECT}/kaniko-executor:v1.27.6-debug
+                    command:
+                      - /kaniko/executor
+                    args:
+                      - --dockerfile=/workspace/frontend/Dockerfile
+                      - --context=dir:///workspace/frontend
+                      - --build-arg=NEXT_PUBLIC_API_URL=https://api.abrban.com
+                      - --destination=${REGISTRY}/${PROJECT}/cloudhost-frontend:${IMAGE_TAG}
+                      - --insecure
+                      - --skip-tls-verify
+                    volumeMounts:
+                      - name: ws
+                        mountPath: /workspace
+                volumes:
+                  - name: ws
+                    emptyDir: {}
+          ENDJOB
+          echo "Waiting for frontend build..."
+          kubectl -n ${BUILD_NS} wait --for=condition=complete job/build-frontend-${IMAGE_TAG} --timeout=20m
+          echo "Frontend build done"
 
       - name: Update GitOps values
-        shell: bash
+        shell: sh
         run: |
           sed -i "s|tag: \"[^\"]*\"|tag: \"${IMAGE_TAG}\"|g" gitops/platform/values-abrban.yaml
           git config user.email "ci@abrban.com"
@@ -53,9 +130,6 @@ jobs:
           git diff --cached --quiet || git commit -m "ci: deploy platform ${IMAGE_TAG}"
 
       - name: Push GitOps update
-        shell: bash
+        shell: sh
-        env:
-          GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          git remote set-url origin "https://oauth2:${GITEA_TOKEN}@git.abrban.com/abrban/cloud-host.git"
           git push origin HEAD:main

gitops/gitea/act-runner.yaml

@@ -1,4 +1,5 @@
-# Gitea Actions runner — host mode + Kaniko (no docker.sock; k3s uses containerd)
+# Gitea Actions runner — host mode (no docker.sock; k3s uses containerd)
+# Runner creates Kaniko Jobs in cloudhost-builds for image builds.
 apiVersion: v1
 kind: Secret
 metadata:
@@ -8,6 +9,37 @@ type: Opaque
 stringData:
   token: "nL63VkZEyqpCNFdF3AMM9wzQLdLlATUvXSe5Tj0R"
 ---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: gitea-act-runner
+  namespace: gitea
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: gitea-act-runner
+rules:
+  - apiGroups: ["batch"]
+    resources: ["jobs"]
+    verbs: ["create", "get", "watch", "list", "delete"]
+  - apiGroups: [""]
+    resources: ["pods", "pods/log"]
+    verbs: ["get", "watch", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: gitea-act-runner
+subjects:
+  - kind: ServiceAccount
+    name: gitea-act-runner
+    namespace: gitea
+roleRef:
+  kind: ClusterRole
+  name: gitea-act-runner
+  apiGroup: rbac.authorization.k8s.io
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -23,23 +55,32 @@ spec:
       labels:
         app: gitea-act-runner
     spec:
+      serviceAccountName: gitea-act-runner
       imagePullSecrets:
         - name: registry-pull-secret
       initContainers:
-        - name: kaniko-bin
+        - name: install-kubectl
-          image: registry.abrban.com/abrban/kaniko-executor:v1.23.2
+          image: registry.abrban.com/abrban/alpine:3
           imagePullPolicy: IfNotPresent
-          command: ["sh", "-c", "cp /kaniko/executor /kaniko-bin/executor && chmod +x /kaniko-bin/executor"]
+          env:
+            - name: HTTPS_PROXY
+              value: "http://builder:BeeldiOr!12009@45.129.38.203:9911"
+          command:
+            - sh
+            - -c
+            - |
+              wget -q "https://dl.k8s.io/release/v1.35.0/bin/linux/amd64/kubectl" -O /tools/kubectl
+              chmod +x /tools/kubectl
           volumeMounts:
-            - name: kaniko-bin
+            - name: tools
-              mountPath: /kaniko-bin
+              mountPath: /tools
       containers:
         - name: runner
           image: registry.abrban.com/abrban/act-runner:0.2.11
           imagePullPolicy: IfNotPresent
           env:
             - name: GITEA_INSTANCE_URL
-              value: https://git.abrban.com
+              value: http://gitea-http.gitea.svc.cluster.local:3000
             - name: GITEA_RUNNER_REGISTRATION_TOKEN
               valueFrom:
                 secretKeyRef:
@@ -48,10 +89,15 @@ spec:
             - name: GITEA_RUNNER_NAME
               value: k8s-abr-runner
             - name: GITEA_RUNNER_LABELS
-              value: abrban-kaniko:host
+              value: abrban-builder:host
           volumeMounts:
-            - name: kaniko-bin
+            - name: tools
-              mountPath: /kaniko
+              mountPath: /usr/local/bin/kubectl
+              subPath: kubectl
+            - name: runner-data
+              mountPath: /data
       volumes:
-        - name: kaniko-bin
+        - name: tools
+          emptyDir: {}
+        - name: runner-data
           emptyDir: {}

gitops/jobs/seed-ci-images.yaml

@@ -14,7 +14,8 @@ spec:
         - name: registry-pull-secret
       containers:
         - name: skopeo
-          image: registry.abrban.com/proxy-quay/skopeo/stable:latest
+          image: quay.io/skopeo/stable:latest
+          imagePullPolicy: IfNotPresent
           envFrom:
             - secretRef:
                 name: registry-egress-proxy
@@ -24,10 +25,11 @@ spec:
             - |
               set -eux
               DEST="docker://harbor-registry.cloudhost.svc.cluster.local:5000/abrban"
-              skopeo copy --dest-tls-verify=false \
+              CREDS="harbor_registry_user:harbor_registry_password"
-                docker://docker.gitea.com/gitea/act_runner:0.2.11 \
+              skopeo copy --dest-tls-verify=false --dest-creds="${CREDS}" \
+                docker://docker.io/gitea/act_runner:0.2.11 \
                 "${DEST}/act-runner:0.2.11"
-              skopeo copy --dest-tls-verify=false \
+              skopeo copy --dest-tls-verify=false --dest-creds="${CREDS}" \
                 docker://gcr.io/kaniko-project/executor:v1.23.2 \
                 "${DEST}/kaniko-executor:v1.23.2"
               echo SEED_OK